ci(fuzz): fix AFL runtime build and gate PRs on deep-fuzz

[joeldsouzax]

Problem

The deep-fuzz-afl leg has failed every nightly since it landed in #99 — it never had a green scheduled run. All 12 AFL jobs die in Build AFL++ runtime:

called `Result::unwrap()` on an `Err` value: AFL LLVM runtime was already built for Rust rustc-1.95.0-5980761; run `cargo afl config --build --force` to rebuild it.

cargo install cargo-afl (0.18.2) already leaves the runtime built for the active rustc, so the explicit plain cargo afl config --build panics on "already built". The 13 libFuzzer jobs are unaffected (all green).

On top of that, the workflow only ran on schedule/workflow_dispatch, so fuzz breakage was discovered the morning after merge instead of blocking the PR that introduced it.

Fix

• cargo afl config --build --force — rebuilds unconditionally, as the tool's own error message instructs; covers both the pre-built and not-built cases.

Fuzzing as a merge gate

• pull_request trigger (targeting main): PRs run a 60s-per-target smoke fuzz on both engines; nightly keeps 120s and workflow_dispatch duration still takes precedence.
• PR runs never write the corpus: they seed from the latest successful main corpus (the restore step already filters --branch main) but skip minimize + upload, so corpus compounding stays a nightly concern.
• fuzz-gate summary job over both engine matrices — one stable check name for branch protection instead of 25 per-target contexts that drift when targets are added. if: always() so a failed/cancelled leg reports as a red ✗ instead of leaving the required check stuck at "Expected".
• Concurrency group cancels superseded PR runs; scoped by event name so it can never cancel a nightly.

After this merges, branch protection on main gains fuzz-gate as a required status check alongside Nix Flake Check.

Verification

• actionlint clean (also enforced by the pre-commit hook and the cesr-actionlint flake check).
• nix flake check passed via the pre-push hook.
• The fuzz-gate check running on this very PR exercises the fixed AFL leg end-to-end.

🤖 Generated with Claude Code

[codspeed-hq]

Merging this PR will not alter performance

✅ 21 untouched benchmarks
⏩ 21 skipped benchmarks¹

---

_{Comparing ci/fuzz-pr-gate (e067c50) with main (593ed4e)}

Footnotes

1. 21 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩